Healthcare security reports

R

ratiopharm GmbH

ratiopharm.com

40

ratiopharm GmbH operates a comprehensive German pharmaceutical website focused on generics and health solutions. The company is a well-established player in the healthcare sector, supported by its parent company Teva Pharmaceutical Industries. The website provides extensive product information, health advice, and services targeted at consumers and healthcare professionals. Technically, the site uses TYPO3 CMS with modern JavaScript frameworks and integrates Google Analytics and Usercentrics for analytics and cookie consent. However, the SSL certificate is invalid or missing, which is a critical security concern. Security headers are mostly implemented, but TLS protocols are disabled, significantly impacting the security posture. Privacy compliance is well addressed with a clear privacy policy and cookie consent mechanism. Contact information is clearly presented, enhancing business credibility.

N

Novo Nordisk A/S

novonordisk.com

40

Novo Nordisk A/S is a leading global healthcare company specializing in the research, development, and marketing of medicines for diabetes and other serious chronic diseases. Founded in 1923 and headquartered in Denmark, the company maintains a strong market position with a comprehensive online presence targeting patients, healthcare professionals, investors, and job seekers. The website reflects a mature business model with extensive investor relations, career opportunities, and patient support information. Technically, the site leverages modern JavaScript frameworks such as Vue.js and is built on Adobe Experience Manager, hosted likely on Microsoft Azure. Privacy compliance is well addressed with clear privacy and cookie policies and consent mechanisms. However, a critical security gap exists due to the absence of a valid SSL certificate and HTTPS support, which significantly impacts the security posture.

V

Vela Labs

vela-labs.at

28

Vela Labs GmbH is a GLP and GMP certified contract laboratory specializing in analytical services for pharmaceutical and biotechnology companies. The company supports all phases of drug development with services including physico-chemical analysis, ligand binding assays, cell based assays, microbiological analysis, clinical sample analytics, and GMP storage. As part of the Tentamus Group, Vela Labs positions itself as a trusted partner with strong compliance credentials and a focus on quality and regulatory adherence. The website demonstrates a professional digital presence built on WordPress with SEO and analytics integrations, targeting pharma and biotech professionals. However, the absence of a valid SSL certificate and HTTPS support is a critical security gap that undermines user trust and data protection. Privacy policies and cookie consent mechanisms are well implemented, reflecting GDPR compliance. Overall, the company shows a solid market position but should urgently address its SSL/TLS configuration to improve security posture and user confidence.

E

Eurofins Scientific

eurofins.com

40

Eurofins Scientific operates a comprehensive global network of laboratory testing services specializing in food, environment, pharmaceutical product testing, and agroscience CRO services. With approximately 63,000 employees and over 950 laboratories across 60 countries, Eurofins is a world leader in its sector, offering more than 200,000 analytical methods. The website reflects this extensive business scope with detailed service offerings and a strong global presence. Technically, the site uses modern JavaScript libraries and analytics tools, but suffers from critical SSL/TLS configuration issues that undermine its security posture. Security headers are implemented, but the lack of a valid SSL certificate and disabled TLS protocols represent significant vulnerabilities. Privacy compliance is well addressed with cookie consent mechanisms and privacy policies in place. Overall, the site is professional and trustworthy but requires urgent remediation of its SSL/TLS issues to ensure secure user interactions.

N

NCT Heidelberg

nct-heidelberg.de

40

NCT Heidelberg is a prominent German healthcare and research institution specializing in oncology. The website serves multiple audiences including patients, physicians, and researchers, offering comprehensive information on patient care, clinical studies, and cancer research programs. The site is well-structured and professionally designed, reflecting its institutional nature and affiliations with major German research and medical organizations. Technically, the website is built on TYPO3 CMS and integrates modern consent management tools like Usercentrics, alongside Matomo for privacy-focused analytics. However, the absence of a valid SSL certificate is a critical security flaw that undermines user trust and data protection. Security headers are partially implemented, but DNSSEC and proper CAA records are missing, indicating room for improvement in DNS security. Privacy compliance is strong with clear GDPR mechanisms in place. Overall, the site demonstrates good business credibility and content quality but requires urgent security enhancements to meet modern standards.

S

Stryker

stryker.com

40

Stryker is a large multinational healthcare company specializing in medical devices and healthcare solutions, serving a global audience including healthcare professionals and patients. The website serves as an international homepage with localized country sites, reflecting a broad global presence. Technically, the site is built on Adobe Experience Manager and hosted via AWS CloudFront, utilizing various marketing and analytics technologies such as Adobe DTM, Google Analytics, and Marketo. However, the website lacks a valid SSL certificate and does not serve content over HTTPS, which is a critical security deficiency. Security headers are implemented but cannot compensate for the absence of HTTPS. Privacy and cookie policies are not found, and no explicit contact information is provided on the homepage, which impacts privacy compliance and user trust. Overall, the site demonstrates moderate business credibility but requires urgent improvements in security and privacy compliance to meet modern standards.

B

Belimed INC.

belimed.com

40

Belimed INC. is a large healthcare-focused company specializing in medical and surgical instrument sterilization, disinfection, and cleaning products and services. The company positions itself as a trusted partner in advancing medical care and protecting patient and staff safety, with a global presence and over 1,000 employees across nine countries. Their business model is primarily B2B, serving sterile processing departments and healthcare providers with a comprehensive portfolio including washer-disinfectors, sterilizers, digitalization solutions, and training services. Technically, the website is built on modern frameworks such as Nuxt.js and Vue.js, with Tailwind CSS for styling. It integrates multiple analytics and marketing tools including Google Analytics, Facebook Connect, LinkedIn Pixel, and Calendly. The site is well-optimized for mobile and accessibility, with clear navigation and professional design. However, the SSL certificate is invalid or missing, which significantly impacts the security posture. From a security perspective, the site implements several important HTTP security headers and a restrictive Content-Security-Policy, but the lack of a valid SSL certificate and incomplete HSTS implementation are critical weaknesses. No explicit security or incident response policies are found, and there is no vulnerability disclosure or security.txt file. Privacy compliance is strong, with clear privacy and cookie policies and consent mechanisms in place. Overall, the website is professional and trustworthy from a business and content perspective but requires urgent remediation of SSL issues to improve security and user trust. Strategic improvements in security policy transparency and incident response readiness are also recommended.

N

Novotech

novotech-cro.com

40

Novotech is a globally recognized full-service clinical research organization (CRO) specializing in supporting biotech and small to mid-sized pharmaceutical companies with clinical trial services and scientific advisory. The company has a strong market position in the Asia-Pacific region and globally, supported by multiple industry awards and a comprehensive portfolio of services including medical consulting, patient recruitment, clinical operations, biometrics, virtual trials, and laboratory services. The website reflects a mature digital presence with multilingual support, professional design, and clear navigation tailored to its target audience of biopharmaceutical sponsors. Technically, the website is built on Drupal 10 and hosted on Pantheon, utilizing modern web technologies and third-party integrations such as OneTrust for cookie consent and Google Tag Manager for analytics. The site is mobile-optimized and accessible, with good SEO practices and structured data for enhanced search visibility. From a security perspective, while the site implements several important HTTP security headers and content security policies, it critically lacks a valid SSL certificate and does not support any TLS protocols, severely impacting the security posture and user trust. Privacy compliance is well addressed with clear policies and consent mechanisms. Business credibility is high, supported by consistent branding, professional content, and trust indicators. Overall, the site presents a professional and trustworthy front for Novotech but urgently requires remediation of its SSL/TLS configuration to ensure secure communications and compliance with modern security standards.

M

MedMedia Group

medmedia.ie

38

MedMedia Group is a specialist healthcare communications and marketing agency based in Ireland, focusing on delivering publishing expertise combined with design, digital innovation, and marketing services tailored to the healthcare sector. Their market position is that of a niche provider serving healthcare clients with a broad spectrum of services including publications, web and mobile development, brand identity, and event management. The website content is professional and well-structured, targeting healthcare organizations in Ireland. Technically, the website runs on an Apache server with a Foundation CSS framework and uses several JavaScript libraries including jQuery 1.11.0, Font Awesome, and Animate.css. Google Analytics is integrated for user tracking. However, the site lacks a valid SSL certificate, resulting in no HTTPS support, which is a critical security and trust issue. Performance data is missing but inferred to be slow, and mobile optimization is basic. SEO and accessibility features are present but minimal. From a security perspective, the site has some security headers configured but fails to provide a valid SSL/TLS configuration, exposing users to risks. There are no visible privacy or cookie policies, and no incident response or vulnerability disclosure information is provided. The absence of GDPR compliance indicators and cookie consent mechanisms further weakens the privacy posture. Overall, the website demonstrates moderate business credibility and good content quality but suffers from critical security shortcomings due to lack of HTTPS and privacy compliance. Strategic improvements in SSL configuration, privacy policies, and updated technology stacks are recommended to enhance trust and security.

M

MBI Institut für Marketingberatung

mbi.eu

23

MBI Institut für Marketingberatung is a healthcare-focused private broker based in Austria, specializing in increasing accessibility to licensed medical products for vulnerable populations. With over 30 years of experience, the company partners with globally recognized vaccine manufacturers and genetic testing providers to supply governments and NGOs. The website is built on WordPress using Elementor and related plugins, hosted on a LiteSpeed server. While the site is professionally designed and provides clear contact information and GDPR-compliant cookie consent, it lacks a valid SSL certificate and modern TLS support, which is a critical security concern. No explicit security or incident response policies are found, and no vulnerability disclosure mechanisms are present. Overall, the business appears credible and established, but the technical security posture requires urgent improvement.

H

Hilfswerk Österreich

hilfswerk.at

36

Hilfswerk Österreich is a large, well-established non-profit organization providing extensive health, social, and family services across Austria. The website reflects a professional and comprehensive digital presence, targeting a broad audience including elderly people, children, families, and caregivers. The organization maintains a strong market position as one of Austria's leading providers in its sector, supported by government funding and a wide range of services. Technically, the website is built on TYPO3 CMS with modern frontend libraries and includes accessibility and SEO best practices. However, a critical security gap exists due to the absence of a valid SSL certificate and HTTPS support, which significantly undermines the site's security posture. Privacy compliance is well addressed with clear cookie consent mechanisms and a comprehensive privacy policy. Overall, the site demonstrates high professionalism and trustworthiness but urgently requires SSL implementation to mitigate security risks.

The website represents a small private psychotherapy practice operated by Darchelle Worley MA, LMHC, based in Seattle, Washington. The business focuses on providing individual and group therapy services to adults and adolescents, emphasizing present-focused change and healing from past traumas. The site content is relevant and consistent with the healthcare sector, targeting clients seeking mental health support. Technically, the website is built on a legacy stack using Apache server and older versions of jQuery. It lacks a CMS and modern web technologies, resulting in basic mobile optimization and slow performance. The site is served over HTTP without a valid SSL certificate, which is a significant security concern. Google Analytics is used for tracking, but no privacy or cookie policies are present, indicating poor privacy compliance. From a security perspective, the absence of HTTPS, lack of security headers, and missing DNS security features such as DNSSEC and CAA records expose the site to risks. No incident response or security policies are published, and no forms are present to collect user data, reducing attack surface but also limiting user engagement. The domain's DNS records are incomplete or missing, and no SSL certificate is installed, which undermines trust and legitimacy. Overall, the website scores low on security and privacy compliance, moderate on business credibility and content quality, and basic on technical implementation. Strategic improvements in SSL deployment, privacy policy publication, and security header implementation are critical to enhance trust and compliance.

L

LKB

lkb.eu

23

LKB is a small healthcare-focused company based in Austria, specializing in the supply and distribution of life science and routine medical diagnostics products. The company holds ISO 9001 certification and emphasizes customer and technical support, targeting laboratories and medical diagnostics professionals. The website presents a professional design with clear navigation and relevant content, supporting the company's market position as a trusted supplier in the region. Technically, the website uses modern frontend technologies such as Bootstrap 5 and jQuery, hosted on SuperHosting.bg, but lacks HTTPS support and advanced security configurations, which significantly impacts its security posture. The absence of SSL/TLS encryption and security headers exposes the site to risks and undermines user trust. Privacy compliance is minimal, with a privacy policy present but no cookie policy or consent mechanisms. Contact information is comprehensive and clearly displayed, enhancing business credibility. Overall, while the business and website demonstrate professionalism and market relevance, critical security improvements are necessary to protect users and data.

P

Patheon pharma services - Global CDMO

patheon.com

39

Patheon pharma services, a brand under Thermo Fisher Scientific, operates as a global contract development and manufacturing organization (CDMO) serving the pharmaceutical, biotech, and life sciences industries. The website presents a comprehensive portfolio of services including small and large molecule development, advanced therapies, clinical trial services, and commercial manufacturing. Positioned as a trusted partner with a global footprint, Patheon emphasizes integrated solutions and innovative drug development approaches to accelerate treatments to market. The business model focuses on end-to-end drug development and manufacturing partnerships, targeting pharmaceutical and biotech companies worldwide. The domain is mature and strongly protected, reflecting a stable and legitimate enterprise presence. Technically, the website is built on Adobe Experience Manager (AEM) and leverages modern JavaScript libraries such as jQuery, FontAwesome, and Slick Carousel, alongside marketing and analytics tools like Adobe Target and Genesys Messenger. Hosting and content delivery are managed via Akamai CDN, ensuring global reach and performance. The site is mobile optimized with good SEO practices and structured data for enhanced search visibility. However, performance metrics are not explicitly available. From a security perspective, the site lacks a valid SSL/TLS certificate and does not serve content over HTTPS, which is a critical vulnerability impacting user trust and data security. While some security headers are present, the misconfiguration of HSTS and absence of modern TLS protocols and cipher suites significantly weaken the security posture. Privacy compliance is well addressed through comprehensive privacy and cookie policies linked to the parent company’s domain, with GDPR compliance implied. Contact information is primarily via web forms, with no direct emails or phone numbers prominently displayed. Overall, the website demonstrates strong business credibility and professional digital presence but requires urgent remediation of its SSL/TLS and HTTPS implementation to meet modern security standards and protect user data. Strategic improvements in security configuration and explicit contact channels would enhance trust and compliance.

A

Arzneiwerk AG

teles.com

38

Arzneiwerk AG is a healthcare company specializing in securing the supply of newly developed or rare specialty pharmaceuticals across Europe. The company maintains a professional online presence focused on investor relations and business transparency. The website is built on WordPress using Elementor and includes SEO and cookie consent tools, indicating a moderate level of digital maturity. However, the absence of a valid SSL certificate and HTTPS support represents a significant security gap, exposing users to potential risks. Privacy policies are present and GDPR compliant, but no explicit security or incident response policies are found. Overall, the business appears legitimate and consistent with its domain registration and content, but security improvements are critical to enhance trust and compliance.

D

Dr. Andreas Riedler Facharzt für HNO, Kopf- und Halschirurgie

der-hno-arzt.at

40

Dr. Andreas Riedler operates a specialized ENT medical practice based in Wels, Austria, providing comprehensive ear, nose, and throat healthcare services including examinations, therapies, and surgeries. The website targets local patients seeking trusted medical care and emphasizes personalized patient relationships and appointment scheduling. Technically, the website is built on a CMS platform (ZMS) with standard web technologies and integrates Matomo analytics for user behavior tracking with privacy opt-out features. However, the absence of a valid SSL certificate and lack of modern TLS protocols represent significant security weaknesses that undermine user trust and data protection. Privacy and cookie policies are present but basic, and no terms of service or incident response policies are published. Overall, the website is functional and professionally presented but requires urgent security improvements to meet modern standards.

Ö

Österreichische Gesundheitskasse

ooegkk.at

40

The Österreichische Gesundheitskasse (ÖGK) operates as a major public health insurance provider in Austria, delivering comprehensive health insurance services and support to insured individuals, employers, and contract partners. The website serves as an official portal offering information, appointment scheduling, customer service, and career opportunities, targeting Austrian residents and stakeholders in the healthcare sector. The digital presence is supported by a modern technology stack including Apache, Jakarta Faces, and jQuery, managed via a Gentics CMS platform, and hosted within the Austrian social insurance infrastructure. Despite a professional and content-rich website, the absence of a valid SSL certificate and HTTPS support significantly undermines the security posture. The site implements a strong Content Security Policy and cookie consent mechanisms, reflecting good privacy compliance, but the lack of HTTPS and TLS protocols is a critical vulnerability. Social media integration and clear contact information enhance trust and user engagement. Overall, the website is functional and credible but requires urgent security improvements to protect user data and comply with modern standards.

B

BBMRI-ERIC

bbmri-eric.eu

26

BBMRI-ERIC is a European research infrastructure focused on biobanking and biomolecular resources, supporting researchers in health and life sciences to find new treatments. Established in 2013 and headquartered in Graz, Austria, it provides a range of services including a directory of biobank metadata, federated platforms for privacy-preserving data queries, and quality management. The website reflects a mature organization with consistent branding and professional content aimed at the scientific community. Technically, the site is built on WordPress with a variety of plugins supporting SEO, newsletter management, and social media integration. However, the site lacks HTTPS and a valid SSL certificate, which is a critical security vulnerability. Privacy compliance is well addressed with clear privacy and cookie policies and consent mechanisms. Overall, the site is trustworthy but requires urgent security improvements to protect user data and maintain credibility.

M

Microlife AG

microlife.ch

37

Microlife AG is a well-established Swiss company specializing in the development and production of medical diagnostic devices such as blood pressure monitors, thermometers, and respiratory therapy equipment. The company holds a strong market position as a world leader in healthcare technology, targeting both home users and healthcare institutions. Their website reflects a professional and consistent brand image with multilingual support and a comprehensive product portfolio. Technically, the website uses modern JavaScript and tracking tools but lacks a valid SSL certificate, which is a significant security concern. The absence of HTTPS undermines user trust and exposes data to interception risks. Privacy compliance is well addressed with a cookie consent mechanism and clear privacy policies. However, no explicit security or incident response policies are publicly available. Overall, the site is functional and informative but requires urgent security improvements to align with best practices and user expectations.

W

WELLCON

wellcon.at

22

Wellcon is an established Austrian company specializing in occupational health, safety, and workplace wellness services. With 25 years of experience and multiple locations, it serves companies seeking comprehensive occupational medicine, psychology, and safety technology solutions. The website is professionally designed using WordPress and Elementor, featuring good content quality and SEO optimization. However, the technical infrastructure lacks a valid SSL certificate, resulting in no HTTPS support, which is a critical security vulnerability. Privacy compliance is basic, with a privacy policy present but no cookie consent mechanism despite the use of Matomo analytics. Contact information is not explicitly provided on the homepage or footer, limiting direct communication channels. Overall, the business credibility is strong, but the security posture requires urgent improvement to protect user data and enhance trust.

Tyrol Air Ambulance is a well-established Austrian company specializing in worldwide medical air transport and assistance services. With over 40 years of experience, it operates a dedicated fleet of ambulance jets equipped with advanced medical technology and staffed by experienced medical professionals. The company holds multiple industry awards and accreditations, positioning itself as a leading provider in the air ambulance sector. The website reflects a professional and content-rich presence targeting patients, healthcare providers, and insurance companies requiring medical repatriation and emergency transport services. Technically, the website employs a traditional technology stack with jQuery and several plugins, and uses Matomo for privacy-conscious analytics. However, the absence of HTTPS and a valid SSL certificate is a critical security shortfall, exposing users to risks and undermining trust. Security headers are minimal, and no incident response or vulnerability disclosure policies are publicly available. Overall, the site is well-branded and informative but requires urgent security improvements to align with best practices and regulatory expectations.

F

Franziskus Spital GmbH

franziskusspital.at

30

Franziskus Spital GmbH operates as a non-profit healthcare provider with two hospital locations in Vienna, Austria, offering a broad range of medical services including internal medicine, surgery, anesthesiology, and specialized centers such as hernia surgery and breast health. The website targets patients, visitors, referring physicians, and career seekers, positioning itself as a regional healthcare institution with a focus on individualized medicine and comprehensive patient care. Technically, the website employs a mix of legacy and modern JavaScript libraries and includes Google Analytics and a cookie consent mechanism, indicating a moderate level of digital maturity. However, the absence of a valid SSL certificate and HTTPS support is a critical security shortfall that undermines user trust and data protection. Security headers are partially implemented but lack advanced protections such as HSTS and DNSSEC. Privacy compliance is well addressed with a comprehensive privacy policy and cookie consent. Overall, the site is professionally designed and content-rich but requires urgent security improvements to meet modern standards.

Ö

Österreichische Gesundheitskasse

meineoegk.at

40

The website meineoegk.at serves as the official service portal for the Österreichische Gesundheitskasse, Austria's public health insurance provider. It offers a broad range of online services including e-Rezept, insurance data access, pension applications, and various social insurance related forms. The portal targets insured Austrian residents and provides a secure login mechanism via ID Austria, ensuring user data protection and access control. The site is professionally designed with clear navigation and comprehensive content relevant to its audience. Technically, it employs a custom CMS with Jakarta Faces framework and uses modern JavaScript libraries such as jQuery 3.6.0 and Slick Carousel for UI components. Analytics is managed through Piwik PRO with user consent mechanisms in place, reflecting good privacy practices. However, a critical security gap exists due to the absence of a valid SSL certificate and HTTPS support, severely impacting the site's security posture. The Content Security Policy is robust but includes unsafe directives that could be improved. Overall, the site is trustworthy and authoritative but requires urgent security enhancements to protect user data and comply with best practices.

Henry Schein, Inc. is a well-established global distributor of medical and dental supplies, serving healthcare professionals with a broad portfolio of products and services. The company holds a strong market position as a Fortune 500 enterprise with a history dating back to 1932. Their website reflects a professional and consistent brand image targeting dental and medical professionals, offering solutions ranging from supplies to practice management software and educational resources. Technically, the site is built on a Microsoft IIS and ASP.NET stack, leveraging multiple third-party marketing and analytics tools, with moderate performance and good mobile optimization. However, the SSL certificate is invalid or missing, which significantly impacts the security posture. While security headers and content security policies are implemented, the lack of valid HTTPS and modern TLS protocols is a critical vulnerability. Privacy compliance is basic, with no visible cookie consent mechanism or GDPR indicators, and no public security or incident response policies. Overall, the website is functional and credible but requires urgent improvements in SSL configuration and privacy compliance to enhance trust and security.

M

Memorial Healthcare System

mhs.net

37

Memorial Healthcare System is a well-established nonprofit healthcare provider based in South Florida, offering a wide range of medical services including cancer care, heart and vascular treatment, maternity, mental health, and rehabilitation. The organization targets both patients and medical professionals, positioning itself as a leader in the regional healthcare market with multiple accreditations and a strong community presence. The website reflects a professional and comprehensive digital presence with clear navigation, rich content, and consistent branding. Technically, the site is hosted on Microsoft Azure using ASP.NET and integrates modern web technologies and analytics tools such as Google Tag Manager and Azure Application Insights. However, a critical security gap exists due to the absence of a valid SSL/TLS certificate and HTTPS support, exposing users to potential risks. Privacy and cookie policies are present and GDPR compliant, with consent mechanisms implemented. Overall, the site demonstrates high business credibility but requires urgent security improvements to protect user data and maintain trust.

Takeda Pharma A/S, a subsidiary of Japan's largest pharmaceutical company, operates a comprehensive and professionally designed Danish website that reflects its global presence and commitment to healthcare innovation. The company focuses on developing and providing innovative pharmaceutical solutions, emphasizing patient access and collaboration with healthcare partners. The website demonstrates strong digital maturity with modern technologies like Next.js and React, hosted on Cloudflare and Vercel, and integrates privacy and cookie compliance mechanisms effectively. However, a critical security gap exists due to the absence of a valid SSL certificate, which undermines the site's security posture. While security headers and best practices are partially implemented, the lack of HTTPS significantly impacts the overall security score. The site provides clear contact information, social media links, and extensive business information, reinforcing its credibility. Strategic recommendations include immediate SSL certificate renewal, full HSTS implementation, and enhanced security policy disclosures to improve trust and compliance.

W

Wellspect HealthCare

wellspect.com

35

Wellspect HealthCare is a global MedTech company specializing in continence care solutions, supporting individuals with urinary and bowel dysfunction through innovative products and educational resources. The company holds a strong market position with over 40 years of industry experience and operates under the parent company Dentsply Sirona. Their website reflects a professional and consistent brand image targeting carers, specialists, and new users in continence care. Technically, the website employs modern analytics and marketing tools such as Microsoft Application Insights, Google Tag Manager, and Salesforce Lightning, hosted behind Cloudflare. However, the absence of a valid SSL certificate and HTTPS implementation is a critical security flaw, severely impacting the site's security posture. Privacy compliance is partial, with a comprehensive privacy policy present but lacking a cookie consent mechanism despite active tracking scripts. Overall, the website offers excellent content quality and user experience but requires urgent security improvements to protect user data and enhance trust.

The website dondusang.net represents the official French public blood service, Etablissement français du sang (EFS). It provides comprehensive information and services related to blood, plasma, and platelet donations across France. The site is well-branded, content-rich, and targets donors, associations, and the general public with clear calls to action and partner engagement. Technically, the site is built on Drupal CMS, uses modern tracking and analytics tools, and integrates multiple partner domains. However, it lacks HTTPS support, which is a critical security flaw exposing users to risks. Security headers are well configured but cannot compensate for the absence of SSL/TLS. Privacy policies and cookie consent mechanisms are present and GDPR compliant. Overall, the site demonstrates a high level of professionalism and trustworthiness but requires urgent security improvements.

x-tention is a medium-sized Austrian IT company specializing in comprehensive IT solutions for the healthcare and social sectors. Founded in 2001 and part of the xt Unternehmensgruppe, it offers consulting, software development, data science, managed services, and cybersecurity. The company targets healthcare providers and social organizations, emphasizing innovative and secure digital health solutions. The website is professionally designed, content-rich, and well-structured, supporting multiple languages and providing clear contact and support channels. Technically, the site uses Drupal 10 and modern web technologies, but suffers from critical security issues due to the absence of a valid SSL certificate and HTTPS support, severely impacting its security posture. Privacy compliance is strong with clear cookie consent mechanisms and GDPR-aligned policies. Overall, the business credibility is high, but urgent improvements in SSL/TLS implementation are needed to secure user data and trust.

B

Barmherzige Brüder Wien

bbwien.at

38

Barmherzige Brüder Wien operates as a large, well-established non-profit hospital in Austria, providing a broad range of medical services and patient care. The website reflects a mature digital presence with comprehensive content, clear navigation, and active social media engagement. Technically, the site uses a modern CMS (siteswift) and popular JavaScript libraries to enhance user experience. However, a critical security gap exists due to the absence of a valid SSL/TLS certificate, resulting in all traffic being served over HTTP, which exposes users to potential interception risks. The site implements GDPR-compliant privacy and cookie consent mechanisms, indicating awareness of privacy regulations. WHOIS data confirms domain legitimacy and consistency with the hospital's identity. Overall, the site is professional and trustworthy but urgently requires HTTPS implementation to secure user data and improve security posture.

B

Bayer G4A

grants4apps.com

36

Bayer G4A operates as a healthcare innovation accelerator focused on digital health startups, providing funding, consulting, and expertise to scale businesses that transform healthcare experiences. The website positions Bayer G4A as a leading pharmaceutical accelerator with a portfolio of over 150 startups and multiple commercial collaborations worldwide. Technically, the site is built on modern frameworks such as Next.js and hosted on Vercel, with content managed via Builder.io, reflecting a contemporary digital infrastructure. However, the site lacks a valid SSL certificate and proper HTTPS configuration, which is a critical security concern. Additionally, privacy and cookie policies are not found, and direct contact information such as emails or phone numbers is absent, limiting transparency and user trust. Overall, the site demonstrates moderate business credibility and technical maturity but requires urgent security and privacy improvements.

S

Sonnenberg-Apotheke, Helge Lehnert e.K.

sonnenberg-apotheke.com

38

Sonnenberg-Apotheke is a well-established local pharmacy in Chemnitz, Germany, operating since 2001. The business offers a range of pharmaceutical services including certified travel vaccination advice, medication reservation, rental of medical devices, and substitution care for opioid-dependent patients. The website reflects a professional and consistent brand presence targeting local customers with additional online service capabilities. Technically, the site uses a modern front-end stack with Foundation framework and common JS libraries but lacks performance metrics and has no valid SSL certificate, which is a critical security concern. Security headers are partially implemented but the absence of HTTPS and modern TLS protocols significantly weakens the security posture. Privacy and cookie policies are present, indicating GDPR awareness, though the cookie consent mechanism is minimal. Contact information is clearly provided and consistent with WHOIS data, supporting business credibility. Overall, the site is functional and informative but requires urgent security improvements to protect user data and enhance trust.

Croma-Pharma is a medium-sized Austrian company specializing in minimally invasive aesthetic medical products, including hyaluronic acid fillers, botulinum toxin, skin boosters, and skincare lines with plant-exosomes. The company targets healthcare professionals and aesthetic practitioners, offering both products and business services such as consulting and education. The website is professionally designed with good content quality and clear navigation, supporting multiple languages and regions. Technically, the site uses Silverstripe CMS and integrates Google Analytics and reCAPTCHA for user tracking and security. However, a critical security weakness is the lack of a valid SSL certificate and HTTPS support, exposing users to potential risks. Privacy compliance is well addressed with GDPR-aligned policies and cookie consent mechanisms. Overall, the site demonstrates a solid business presence but requires urgent security improvements to protect user data and enhance trust.

Z

Zentrum für Ethik in der Medizin (ZEM)

medizinethik-frankfurt.de

38

The Zentrum für Ethik in der Medizin (ZEM) was a specialized non-profit center focused on medical ethics, affiliated with the Evangelische Kirche in Hessen und Nassau (EKHN). Founded in 1996, it served as a key institution in the region until its closure in April 2025. The website provides information about its services, publications, and contact details, targeting individuals and organizations interested in medical ethics within the church and healthcare sectors in Germany. Technically, the site is built on TYPO3 CMS and uses Matomo for analytics, indicating a moderate level of digital maturity. However, the absence of a valid SSL certificate and HTTPS support is a critical security shortfall, significantly impacting the site's security posture. The site implements a comprehensive cookie consent mechanism and provides clear privacy policy information, demonstrating good privacy compliance. Overall, the website is functional and professional but requires urgent security improvements to protect user data and enhance trust.

I

Informa Connect Australia

informa.com.au

40

Informa Connect Australia is a leading event organiser specializing in conferences, exhibitions, and corporate training services primarily targeting business professionals in Australia. As part of the global Informa PLC group, it holds a strong market position with a large-scale operational footprint. The website reflects a professional business model focused on event management and corporate learning, supported by a consistent brand presence and trust indicators such as testimonials and social media engagement. Technically, the site is built on WordPress with WooCommerce and uses modern web technologies and frameworks, although performance metrics are unavailable. Security posture is weak due to the absence of a valid SSL certificate and HTTPS support, despite the presence of some security headers and Cloudflare protection. Privacy compliance is moderate with clear privacy and cookie policies and consent mechanisms, but lacks explicit GDPR compliance indicators or security policies. Overall, the site is functional and credible but requires urgent improvements in security infrastructure to protect user data and enhance trust.

KABEG is a major healthcare provider managing five hospitals in the Kärnten region of Austria, employing approximately 8,000 staff. The organization focuses on delivering professional healthcare services with an emphasis on patient well-being and humaneness. The website serves multiple audiences including patients, healthcare professionals, job seekers, and suppliers. Technically, the site is built on TYPO3 CMS with common web technologies such as jQuery and Bootstrap, hosted likely by A1.net. However, the website suffers from a critical security shortfall due to the absence of a valid SSL certificate and HTTPS support, exposing visitors to potential risks. Privacy compliance is well addressed with a comprehensive cookie consent mechanism and GDPR-aligned privacy policy. Business credibility is strong with clear contact information, certifications, and consistent branding.

C

contextflow GmbH

contextflow.com

25

contextflow GmbH is a small Austrian healthcare technology company specializing in AI-powered computer-aided detection software for chest CT scans. Their flagship product integrates directly into PACS systems, targeting radiologists, PACS providers, and pharmaceutical companies. The website is professionally designed with rich content, including scientific research, testimonials, and partner logos, indicating a strong market position in AI medical imaging. Technically, the site runs on WordPress with modern plugins and uses AWS for hosting. However, the security posture is weak due to the absence of a valid SSL certificate and HTTPS support, which is a critical issue. Privacy compliance is well addressed with comprehensive privacy and cookie policies and a consent mechanism. Overall, the site is trustworthy but requires urgent security improvements.

D

decide Clinical Software GmbH

decide-clinical.com

26

decide Clinical Software GmbH operates the GlucoTab platform, a specialized clinical decision support system designed to assist healthcare professionals in managing diabetes patients in hospital settings. The company holds important certifications such as ISO 13485 and MDR Class IIa, underscoring its commitment to quality and regulatory compliance. Their product integrates evidence-based insulin dosing algorithms and workflow digitalization, targeting hospitals and clinical staff. The website is professionally designed, multilingual, and content-rich, reflecting a mature digital presence. However, the lack of a valid SSL certificate and HTTPS support significantly undermines the security posture, especially critical in healthcare. Privacy policies and cookie consent mechanisms are well implemented, supporting GDPR compliance. Contact information and trust indicators are clearly presented, enhancing business credibility.

S

Sanochemia Pharmazeutika GmbH

sanochemia.at

20

Sanochemia Pharmazeutika GmbH is an established Austrian pharmaceutical manufacturer specializing in contrast agents for medical imaging, including MRI and CT products, with a focus on gadolinium-free alternatives to enhance patient safety. The company operates globally with distribution in over 50 countries and offers contract manufacturing and API production services. The website is built on WordPress with modern plugins and multilingual support, providing a professional and content-rich user experience. However, the absence of a valid SSL certificate is a critical security gap, exposing users to potential risks. Privacy policies and cookie consent mechanisms are well implemented, reflecting good GDPR compliance. Overall, the business presents a credible and professional digital presence but must urgently address its SSL/TLS configuration to improve security posture.

ABF Pharmaceutical Services GmbH, part of the GBA Group, specializes in providing comprehensive logistical support for clinical trials, including GMP-certified pharmaceutical services such as kit production, labeling, packaging, storage, and distribution. The company operates internationally with a strong presence in Europe, the USA, and Asia, serving pharmaceutical and biotechnology companies. Their technical infrastructure is modern, leveraging React and Gatsby frameworks hosted on Netlify, with content managed via Storyblok CMS. However, the website lacks a valid SSL/TLS certificate, which significantly impacts its security posture. While security headers are present, the absence of HTTPS and modern TLS protocols exposes the site to risks. Privacy compliance is partially addressed with a cookie consent mechanism but lacks comprehensive GDPR indicators. Overall, the business credibility is strong, supported by clear contact information, certifications, and consistent WHOIS data. Strategic improvements in SSL configuration and security policies are recommended to enhance trust and compliance.

C

CADS GmbH

cads-solution.com

40

CADS GmbH is a specialized software development company focused on innovative medical technology solutions, operating primarily in Austria with a strong partnership with the established KLS Martin Group. Their offerings include advanced software platforms such as IPS Gate® for medical case management, LOG Gate for inventory management, and 3D visualization services, targeting healthcare professionals and institutions worldwide. The website reflects a professional and well-branded digital presence with comprehensive content and multimedia resources. Technically, the site is built on TYPO3 CMS and integrates modern marketing and analytics tools, but suffers from a critical security weakness due to an invalid SSL certificate, undermining HTTPS security. Privacy compliance is well addressed with clear cookie management and GDPR-aligned privacy policies. Overall, the business credibility is high, supported by certifications and partnerships, though the lack of a terms of service page and explicit security policies is noted.

Ö

Österreichische Gesundheitskasse

wgkk.at

40

The Österreichische Gesundheitskasse (ÖGK) operates as a major public healthcare insurance provider in Austria, offering a broad range of health-related services and information to insured individuals, employers, and contract partners. The website serves as a comprehensive portal for health facilities, health services, customer support, appointment scheduling, and career opportunities, targeting Austrian residents and stakeholders in the healthcare sector. The organization maintains a consistent and professional online presence with clear branding and trust signals, including official government domain usage and social media engagement. Technically, the website is built on a mature infrastructure utilizing Apache, Jakarta Faces (JSF), jQuery 3.6.0, and Gentics CMS. It integrates advanced features such as a content slider and Piwik PRO analytics for user behavior tracking. However, performance metrics appear incomplete, and the site shows moderate loading characteristics. Accessibility and SEO optimizations are well addressed, with good mobile responsiveness and clear navigation. From a security perspective, the site implements several best practices including a detailed Content-Security-Policy and HttpOnly, Secure cookie flags. Nevertheless, the absence of a valid SSL certificate and HTTPS support is a critical vulnerability, severely impacting the security posture. Other SSL/TLS features such as modern protocol support, OCSP stapling, and session resumption are missing. Privacy compliance is strong, with GDPR-aligned cookie consent mechanisms and clear privacy policies. Overall, the website is trustworthy and professionally managed but requires urgent security improvements to enable HTTPS and strengthen SSL/TLS configurations. Addressing these issues will enhance user trust, data protection, and compliance with modern security standards.

G

Greiner Bio-One International GmbH

gbo.com

40

Greiner Bio-One International GmbH is a large, globally active company specializing in biotechnology, medical devices, in vitro diagnostics, and research products. The company operates with a strong customer focus and maintains a diversified portfolio with production sites in multiple countries. Their website reflects a mature digital presence with comprehensive product information, news, and resources targeted at healthcare and research professionals. Technically, the site is built on TYPO3 CMS and hosted behind Cloudflare, but suffers from critical security shortcomings including the absence of a valid SSL certificate and disabled TLS protocols, which significantly impact its security posture. Privacy and legal compliance are well addressed with clear policies and consent mechanisms. Overall, the website is professional and trustworthy but requires urgent security improvements to protect user data and maintain trust.

M

MedTriX Group

medizin-medien.at

40

MedTriX Group is a specialized medical communication service provider with a strong presence in Austria, Germany, and Switzerland. The company offers unique healthcare professional (HCP) data intelligence and a broad portfolio of services including data targeting, CRM data quality enhancement, telephone communication, medical media publishing, digital newsletters, and educational events. Their market position is reinforced by a strong regional footprint and partnerships with sister companies MTX Schweiz and MTX Deutschland. Technically, the website is built on WordPress with Elementor and Yoast SEO, indicating a modern CMS and SEO-friendly infrastructure. However, performance metrics are lacking, and the SSL/TLS configuration is critically flawed with no valid certificate and no TLS protocols enabled, which severely impacts security and trust. Security posture is weak due to the invalid SSL certificate and incomplete TLS support, despite the presence of several security headers. Privacy compliance is strong with a clear privacy policy, cookie consent mechanism, and GDPR adherence. Contact information is comprehensive and professionally presented, enhancing business credibility. Overall, the site is functional and professional but requires urgent remediation of SSL/TLS issues to ensure secure communications and maintain trust. Strategic improvements in security configuration and performance optimization are recommended.

D

Dr. Schär AG / SPA

drschaer.com

29

Dr. Schär is a well-established company specializing in products for people with special nutritional needs, particularly in gluten-free and related dietary areas. The company has a strong market position with over 100 years of experience and multiple specialized brands. Their website reflects a professional and consistent brand image, targeting consumers and healthcare professionals. Technically, the site is built on Drupal 9 with the Thunder distribution and incorporates modern web technologies and marketing tools such as Google Tag Manager. However, the absence of a valid SSL certificate and HTTPS support is a critical security weakness that significantly impacts the site's security posture. Privacy compliance is well addressed with a clear privacy policy and cookie consent mechanism. Overall, the site is functional and professional but requires urgent security improvements to protect user data and enhance trust.

R

Research Center Pharmaceutical Engineering GmbH

rcpe.at

25

The Research Center Pharmaceutical Engineering GmbH (RCPE) is a non-profit organization specializing in pharmaceutical process engineering, combining academic expertise from Graz University of Technology, University of Graz, and Joanneum Research GmbH. The company is positioned as a global leader in pharmaceutical innovation, providing advanced scientific solutions including simulation, AI, and quality control to pharmaceutical partners worldwide. The website reflects a professional and consistent brand image targeting pharmaceutical industry stakeholders and researchers. Technically, the site is built on WordPress with modern plugins and themes but lacks a valid SSL certificate, impacting security posture. Borlabs Cookie is used for cookie consent, indicating GDPR compliance efforts. Security best practices are partially implemented but require improvements, especially in SSL configuration and security headers. Overall, the site is trustworthy and credible but should address critical security gaps to enhance user trust and compliance.

H

Herba Chemosan

herba-chemosan.at

38

Herba Chemosan is a large Austrian pharmaceutical wholesaler established in 1916, operating seven logistics centers and serving the entire Austrian pharmacy market. The company offers comprehensive pharmaceutical distribution, logistics, marketing, and IT solutions to pharmacies and pharmaceutical manufacturers. The website is built on WordPress with Elementor and Yoast SEO, presenting professional and rich content targeted at healthcare professionals and partners. However, the site lacks a valid SSL certificate and proper HTTPS configuration, which is a critical security vulnerability. Privacy and cookie policies are well implemented, indicating good GDPR compliance. The absence of explicit security and incident response policies suggests room for improvement in security governance. Overall, the business is credible and well-positioned in the Austrian healthcare sector, but the technical security posture requires urgent enhancement.

Diagnosia.com is a healthcare-focused website offering a medical app designed to support doctors with medication information, dosage guidance, drug interaction alerts, and continuing education resources. The business is positioned as a trusted provider in the Austrian healthcare market, supported by its parent company APOVERLAG. The website uses a professional CMS (TYPO3) and modern frontend frameworks (Bootstrap), indicating moderate digital maturity. However, the site lacks a valid SSL certificate, resulting in no proper HTTPS support, which is a critical security flaw. Security headers are partially implemented but insufficient without HTTPS. Privacy compliance is basic, with no cookie consent mechanism detected, though a comprehensive privacy policy is linked. Contact information is clearly provided, enhancing business credibility. Overall, the site is functional and content-rich but requires urgent security improvements to protect user data and trust.

P

PSI CRO

psi-cro.com

32

PSI CRO is a well-established global Contract Research Organization specializing in clinical trial management and patient enrollment across multiple therapeutic areas. The website presents a professional and comprehensive digital presence, targeting pharmaceutical and biotech companies. Technically, the site is built on WordPress with Elementor and uses modern web technologies, but it suffers from a critical security issue due to the absence of a valid SSL certificate, which undermines HTTPS security. Security headers are properly configured, but the lack of TLS support and valid certificates poses a significant risk. Privacy compliance is well addressed with clear privacy and cookie policies and a consent mechanism. Overall, the site is credible and trustworthy but requires urgent remediation of SSL/TLS issues to improve security posture and user trust.

Bio-Techne is a global enterprise specializing in the development, manufacturing, and supply of high-quality scientific reagents, analytical instruments, and precision diagnostics. The company serves researchers, scientists, and clinicians worldwide through a portfolio of well-known brands including R&D Systems, Novus Biologicals, and ProteinSimple. The website reflects a mature B2B business model with comprehensive product offerings and strong market positioning in the healthcare sector. Digital maturity is evidenced by the use of Drupal 10 CMS, multiple marketing and analytics tools, and a well-structured, content-rich website. However, the site suffers from a critical security shortfall due to the absence of a valid SSL certificate, which undermines user trust and data security. Privacy and cookie policies are well implemented with consent mechanisms, supporting GDPR compliance. Overall, the website is professional and trustworthy but requires urgent security improvements to protect visitors and maintain credibility.